IN THE CLAIMS 

Please amend claims 1, 22, 23, and 39 as set forth herein. All pending claims and 
their present status are produced below. 

1 . (Currently Amended) [[An]] A network application monitoring system, comprising: 

(a) at least one media module coupled to an associated network segment on which 
[[a]] the network application is running, each media module is adapted and configurable for 
monitoring and collecting data relating to traffic on the associated network segment 
corresponding to the network application and for analyzin g, responsive to a trigger condition, 
the collected data for traffic information, wherein each media module is tailored for network 
analysis and is configurable to a monitoring mode or a focus mode to monitor and collect 
data; and 

(b) an application server module coupled to the at least one media module for 
receiving the collected data and the analyzed data and analyzing the collected data and the 
analyzed data for improving the performance of the network application [[and]] for 
configuring the trigger condition and for transmitting the trigger condition to the at least one 
media module configuring the at least one media module in response to the analyzed received 

2. (Original) The system as recited in claim 1, wherein the application server module 
provides at least one of a user interface, provisioning, reports, alarms, statistics, and an 
SNMP agent. 

3. (Original) The system as recited in claim 2, wherein the user interface is accessible 
via an Internet connection. 
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4. (Original) The system as recited in claim 1, wherein the at least one media module 
includes at least two media modules of different types. 

5. (Original) The system as recited in claim 1, further comprising at least one additional 
media module that monitors network traffic not related to the network application. 

6. (Original) The system as recited in claim 1, wherein multiple media modules are 
coupled to a common chassis. 

7. (Original) The system as recited in claim 1, wherein the system is self-managed. 

8. The system as recited in claim 1, wherein the system is remotely upgradeable. 

9. (Original) The system as recited in claim 1 , wherein the application server module 
provides expert functions when analyzing the data. 

10. (Original) The system as recited in claim 1, wherein the application server module 
performs a security analysis based on the data. 

1 1 . (Original) The system as recited in claim 1, wherein the application server module 
performs policy management functions when analyzing the data. 

12. (Original) The system as recited in claim 1, wherein the application server module 
performs accounting functions when analyzing the data. 

13. (Original) The system as recited in claim 1, wherein trigger scripts are used to 
customize the analysis of the data by the application server module. 

14. (Original) The system as recited in claim 1, wherein the application server module 
detects, configures, manages and downloads software to the at least one media module. 
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15. (Original) The system as recited in claim 1, wherein the at least one media module 
preprocesses the data prior to receipt of the data by the application server module. 

16. (Original) The system as recited in claim 1, wherein the application server module 
includes a user interface server for managing interactions with a user, an object repository 
coupled to the user interface server for storing objects, a configuration manager coupled to 
the user interface server for providing access to the objects, a remote network monitoring 
services subsystem coupled to the user interface system for providing remote access to the 
objects, an expert server coupled to the object repository for analyzing data received from a 
media module, and an administrative services subsystem coupled to the user interface server 
for providing administrative functions involving the objects. 

17. (Original) The system as recited in claim 16, wherein the application server module 
further includes at least one of a logging manager for storing logging information, a statistics 
manager for dispatching statistics, an alarm manager for dispatching alarms, an event 
manager for dispatching events, a capture manager subsystem for creating trace files, a 
session manager for managing a user session, a security manager for providing authorization 
levels to users, a registry services subsystem for associating an object with at least one of a 
user and the server system, a triggers manager for managing triggers, and a hardware services 
subsystem for providing communication between the server system and external modules. 

18. (Original) The system as recited in claim 1, wherein the at least one media module 
includes a data collection module for collecting data from a network segment and prepending 
the data with descriptor information, a flow processor for classifying the collected data into a 
plurality of flows, a capture buffer coupled to the flow processor for filtering and buffering 
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the collected data in accordance with the flow processor, and a main processor for processing 
the collected data. 

19. (Original) The system as recited in claim 18, wherein the at least one media module 
performs adaptive priority data filtering, comprising: 

(i.) classifying the data in the network segment into multiple flows; 

(ii.) prioritizing the flows into high and low priority flows; 

(iii.) monitoring an amount of data in the high priority flows; and 

(iv.) reallocating resources from the low priority queue to the high priority 

queue if the amount of data in the high priority flows surpasses a 

predetermined threshold. 

20. (Original) The system as recited in claim 1, wherein the analysis of the data by the 
application server module includes creating reports, graphs and logs based on the monitored 
data; and outputting the reports, graphs and logs to a user. 

2 1 . (Original) The system as recited in claim 1 , wherein the data analysis performed by 
the application server module includes gathering performance data of the application during 
the monitoring; generating a set of metrics in real time based on the performance data; and 
measuring a performance of the application from at least one of a client perspective, a server 
perspective, and a network perspective based on the metrics. 

22. (Currently Amended) A computer program product for monitoring a network 
application, comprising: 

(a) computer code for monitoring and collecting data relating to traffic on a 
network segment corresponding to a network application and for analyzing the collected data 
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for traffic information utilizing a configurable media module tailored for network analysis 
and is configurable to a monitoring mode or a focus mode to monitor and collect data; 

(b) computer code for receiving the data; 

(c) computer code for analyzing the collected data and the analyzed data for 
improving the performance of the network application utilizing an application server module; 
and 

(d) computer code for modifying a trigger condition indicating when to collect 
and analyze the received data; and 

(e) computer code for configuring the media module in response to the analyzed 
received data. 

23. (Currently Amended) A method for monitoring a network application, comprising: 

(a) monitoring and collecting data relating to traffic on a network segment 
corresponding to a network application utilizing a configurable media module tailored for 
network analysis and is configurable to a monitoring mode or a focus mode to monitor and 
collect data; 

(b) analyzing the collected data utilizing a configurable media module tailored for 
network analysis; 

(c) analyzing the collected and analyzed data for improving the performance of 
the network application utilizing an application server module; and 

(d) modifying a trigger condition indicating when to collect and analyze the data; 

and 

(e) configuring the media module in response to the analyzed received data. 
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24. (Original) The method as recited in claim 23, further comprising providing at least 
one of a user interface, provisioning, reports, alarms, statistics, and an SNMP agent. 

25. (Original) The method as recited in claim 24, wherein the user interface is accessible 
via an Internet connection. 

26. (Original) The method as recited in claim 23, further comprising simultaneously 
monitoring different types of data on multiple co-located network segments. 

27. (Original) The method as recited in claim 23, further comprising monitoring network 
traffic not related to the network application. 

28. (Original) The method as recited in claim 23, further comprising performing expert 
functions when analyzing the data. 

29. (Original) The method as recited in claim 23, further comprising performing a 
security analysis based on the data. 

30. (Original) The method as recited in claim 23, further comprising performing policy 
management functions when analyzing the data. 

3 1 . (Original) The method as recited in claim 23, further comprising performing 
accounting functions when analyzing the data. 

32. (Original) The method as recited in claim 23, wherein trigger scripts are used to 
customize the analysis of the data. 

33. (Original) The method as recited in claim 23, further comprising managing 
interactions with a user, storing objects, providing access to the objects, providing remote 
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access to the objects, analyzing data received from a media module, and providing 
administrative functions involving the objects. 

34. (Original) The method as recited in claim 33, further comprising storing logging 
information, dispatching statistics, dispatching alarms, dispatching events, creating trace 
files, managing a user session, providing authorization levels to users, associating an object 
with at least one of a user and the server system, managing triggers, and providing 
communication between the server method and external modules. 

35. (Original) The method as recited in claim 23, further comprising prepending the data 
collected from the network segment with descriptor information, classifying the collected 
data into a plurality of flows, filtering and buffering the collected data in accordance with the 
flow processor, and processing the collected data. 

36. (Original) The method as recited in claim 35, wherein the at least one media module 
performs adaptive priority data filtering, comprising: 

(i.) classifying the data in the network segment into multiple flows; 

(ii.) prioritizing the flows into high and low priority flows; 

(iii.) monitoring an amount of data in the high priority flows; and 

(iv.) reallocating resources from the low priority queue to the high priority 

queue if the amount of data in the high priority flows surpasses a 

predetermined threshold. 

37. (Original) The method as recited in claim 23, further comprising creating reports, 
graphs and logs based on the monitored data; and outputting the reports, graphs and logs to a 
user. 



Case 09665 (Amendment D) 
U.S. Serial No. 10/043,501 



8 



24523/09665/DOCS/1766724.1 



38. (Original) The method as recited in claim 23, wherein the data analysis includes 
gathering performance data of the application during the monitoring; generating a set of 
metrics in real time based on the performance data; and measuring a performance of the 
application from at least one of a client perspective, a server perspective, and a network 
perspective based on the metrics. 

39. (Currently Amended) A network monitoring system, comprising: 

(a) at least one media module coupled to an associated network segment on which 
network traffic is passing, each media module is adapted and configurable for monitoring and 
collecting data relating to the traffic on the associated network segment and for analyzing the 
collected data , responsive to a trigger condition, for traffic information, wherein each media 
module is tailored for network analysis and is configurable to a monitoring mode or a focus 
mode to monitor and collect data; and 

(b) an application server module coupled to the at least one media module for 
receiving the collected and analyzed data^ [[and]] analyzing the received data for improving 
the performance of the network, [[and]] for configuring the trigger condition and for 
transmitting the trigger condition to the at least one media module for configuring the at least 
one media modulo in response to the analyzed rocoivod data . 
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